MITHRIL: Malware Classification Through Lightweight cnn and Uniform Sampling

Abstract

As the cybersecurity landscape continues to evolve, the relentless spread of sophisticated malware poses a substantial threat to the integrity and security of digital systems. A strategic approach to software analysis is malware visualization, a constantly evolving technique that seeks to transform the complex binary code of malware into visual representations by directly mapping the bits of binary code to pixels. The result is then used as training material for computer vision approaches using machine learning or artificial intelligence. Although this approach is being explored with increasingly complex machine learning/artificial intelligence models, it has not been explored in the ever-growing market of smart and other devices, which are typically limited in terms of hardware and computing power. Therefore, we aim to present a reliable and robust approach to malware analysis through visualization, suitable for machines with limited resources and capable of being installed on every node in the network. The proposed approach was tested on two datasets, namely MalImg, Malevis and a variant of the latter, namely Malevis without the 'Other' class, on which three different preprocessing approaches for resource-constrained machines were applied: a linear scaling approach, a bicubic scaling approach, and a strategic image resampling approach on the same hardware. The results show that the proposed pre-processing methods, combined with relatively simple convolutional neural network architectures, achieve the best weighted F1 Score of 96.75% with inference time of 0.2570 seconds compared to more complex models, which achieved the best metric performance of 99.40% and inference time of 1.5982 seconds, representing an overall time cost approximately 6.5 times higher. The proposed resampling approach was also shown to be faster at image conversion and outperform the commonly used image resizing approach.